arXiv:l502.01262v4 [quant-ph] 9 Mar 2016 


Making the decoy-state measurement-device-independent quantum key distribution 

practically useful 


Yi-Heng Zhou 1,2 ,Zong-Wen Yu 1,3 , and Xiang-Bin Wang 1,2,4 
1 State Key Laboratory of Low Dimensional Quantum Physics, Department of Physics, 

Tsinghua University, Beijing 100084, Peoples Republic of China 
2 Synerqetic Innovation Center of Quantum Information and Quantum Physics, University of Science and Technology of China 

Hefei, Anhui 230026, China 

3 Data Communication Science and Technology Research Institute, Beijing 100191, China 
4 Jinan Institute of Quantum technology, SAICT, Jinan 250101, Peoples Republic of China 


The relatively low key rate seems to be the major barrier to its practical use for the decoy state 
measurement device independent quantum key distribution (MDIQKD). We present a 4-intensity 
protocol for the decoy-state MDIQKD that hugely raises the key rate, especially in the case the 
total data size is not large. Also, calculation shows that our method makes it possible for secure 
private communication with fresh keys generated from MDIQKD with a delay time of only a few 
seconds. 
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I. INTRODUCTION 

One of the most important expected advantage for 
Quantum key distribution (QKD)[l, @] is to generate 
fresh secure keys for instant use, so as to achieve a higher- 
level security in private communications. This demands 
a considerably final key generation rate in a time scale 
of seconds. The existing technologies can achieve such a 
goal if the decoy-state BB84 is applied 0-Ell. For ex¬ 
ample, given the system repetition rate of 1 GHz [13 , one 
can make a key rate much higher than the standard of 
GSM(the Global system for mobile communication), 13K 
bits per second (bps), at a rather long distance such as 
50 km. This method can keep the unconditional security 
of QKD with an imperfect single-photon source [16, 17]. 
However, to patch up the security loophole caused by the 
limited detection efficiency (including channel loss) [h|, 
one has to seek other methods such as the so called device 
independent QKD (DI-QKD) 0 and the measurement- 
device independent QKD (MDI-QKD) which was based 
on the idea of entanglement swapping 0, HH. By using 
the decoy-state method, Alice and Bob can use imperfect 
single-photon sources [2jJ, |22| securely in the MDI-QKD. 
The decoy-state MDI-QKD has the advantage of get¬ 
ting rid of all detector side-channel attacks with imper¬ 
fect single-photon sources. The method has been stud¬ 
ied extensively both experimentally [23l - [28j and theoret¬ 
ically m, n-tHi . 

However, the key rate of the decoy-state MDIQKD is 
rather low, e.g., in the well known Hefei experiment [0] , 
it is 0.018 bps over 200 km, with the set up running for 
130 hours. The low key rate seems to be the only barrier 
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to its final practical use. On the other hand, prior art 
results show that, if the statistical fluctuation is taken 
into consideration, we need a large data size so as to 
reach a considerable final key ratejH, til). HI, 111 ]- In 
particular, the number of total pulses at each side N t is 
assumed to be larger than 10 12 . It seems to be rather 
challenging a task to reach a considerable key rate with 
a small data size, such as Nt ~ 10 9 — 10 10 , which can be 
done in a time scale of 1 second or a few seconds, given 
the set-up repetition rate of GHz level fl5l l40j. Note that 
none of the prior art works can generate a final key in 
a considerable key rate given a small data size such as 
N t ~ 10 9 - 10 10 . 

Here we present a method that can produce a key rate 
much higher than any existing theoretical or experimen¬ 
tal results and can generate considerable key rate in a 
very short time. Calculation shows that our method can 
be applied for fresh key generation with decoy-state MDI¬ 
QKD, given the GHz-level set-up repetition rate. 

In what follows, we shall first review the decoy-state 
MDI-QKD and our protocol in section II. We then take 
the improved analysis in section III. There we show a 
very tricky result that the lower bound of the averaged 
value of yield and the upper bound phase-flip error rate 
of all single-photon pairs in both bases can be estimated 
tightly with observed data in X basis only. Based on 
this fact, we show with explicit formulas that instead 
of taking the worst-case estimations for the yield and 
phase-flip error rate of single-photon pairs separately, we 
can treat them jointly pointing directly to the worst-case 
result of the final key rate. We then present the numerical 
simulation results in section IV. The results there show 
huge advantages of this work in the key rates. The article 
is ended with a concluding remark. 
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II. PROTOCOL 

We use subscript A or B to denote a source at Alice’s 
side or Bob’s side. In our protocol, sources xa and yA ( Xb 
and yg) only emit pulses in X basis while source za (~b) 
only emits pulses in Z basis. The protocol needs four 
different states p OA = |0)(0|, p XA , p VA , p ZA ( p OB = |0)(0|, 
Px B , P VB , pz B ) respectively. 

In photon number space, suppose 


Px A = ^2a k \k)(k\, 
k 

Px B = ^2h\k){k\, 
k 

( 1 ) 

Pva = ^2 a 'k\ k )( k l 
k 

Pvb =J2 b 'k\k)(k\, 

k 

( 2 ) 

Pz A =J2a'k\k){k\, 

Pz B =^2K\k)(k\, 

( 3 ) 


k k 


We call xa, xb as well as yA, ys the decoy sources; za, 
Zb the signal sources, and oa , ob the vacuum sources. 

At each time, Alice will randomly choose source Ia 
with probability pi A for l = o,x, y , z. Similarly, Bob will 
randomly choose source rs with probability p rB for r = 
o,x,y,z. The emitted pulse pairs (one pulse from Alice, 
one pulse from Bob) are sent to the un-trusted third party 
(UTP). We shall use notation Ir to indicate the two-pulse 
source when Alice use source l a and Bob use source rs 
to general a pulse pair, e.g., source xy is the source that 
Alice uses source x a and Bob uses source ys ■ Also, here 
in our protocol, the intensity for pulses in Z basis can be 
different from those of X basis, this makes more freedom 
in choosing the intensities and hence further raises the 
key rate. Those effective events caused by pulse pairs 
from source zz will be used for key distillation, while the 
effective events caused by sources in X basis and vacuum 
sources will be used to estimate the yield and the phase- 
flip error rate of the single-photon pulse pairs. 

III. IMPROVED ANALYSIS FOR FINAL KEY 
RATE 

We need lower bound value for sf x , the yield of single¬ 
photon pulse pairs in Z basis. However, as discussed by 
s i nce i R actual applications, the number of pulse 
pairs in Z is much larger than the number of pulse pairs 
in X basis, we can use the lower bound of the averaged 
values of the yield of single-photon pairs in all bases for 
the quantity in Z basis only. A very tricky point here 
is that we can tightly lower bound the yield of all single 
photon pairs using the observed data in A—basis only. 

A. Theorems for statistical fluctuation 

We define the counting rate (yield) of pulses of a cer¬ 
tain set C as 

*-£ < 4 > 


where nc is the number of valid counts due to pulses in 
C, and Nc is the number of pulses in set C. Actually, 
in MDI-QKD, we always use pulses pairs from Alice 
and Bob. So, more strictly speaking, “pulses” above are 
actually “pulse pairs”. Given this definition, we have 
the following theorem: 

Theorem 1: Suppose set Xi = 

{AIi, AT, ■ ■ ■ , AT, ■ ■ ■ Mk} with K > 1, and 
any subset AT; contains Nj^t pulse pairs. Set 

£ = {£ 1 , £21 • • • ) £»,''' ) >Crc}■ Define quantity 

(Sm)c = YH=i c i s Ci with d = The following 

inequality holds with a probability larger than 1 — e: 

- A- < Sm - (Sm)c < A + (5) 

provided that the following conditions hold for any i: 

i) Set AT; is a random subset of £,, i.e., all elements in 
set £; have equal probability to be also an element of set 
AT; AT H AT = <t>, £i H £j = <l) for i ^ j where <j> is the 
empty set; 

ii) All elements in £, are independent and identical. 

As shown in [H, H2], the values A+, A_ can be deter¬ 
mined explicitly by using Chernoff bound given the fail¬ 
ure probability e. Though contents of theorem above 
have been studied and applied elsewhere [13, HH, we 
believe that the theorem presented here offers a clearer 
picture for study of statistical fluctuation in the decoy- 
state MDI-QKD. In particular, in considering the aver¬ 
aged value of yield and phase-flip error rate of the single¬ 
photon pairs, we don’t have to limit them to the average 
over a certain basis, as was so in Ref.[H, [38|, [H|. With 
our theorem 1, we can use the average over pulses in dif¬ 
ferent bases. As demonstrated later in this article, this 
theorem can help us do calculations more efficiently, e.g., 
our theorem 2 and theorem 3. Obviously, this theorem 
also holds for the error yields, and hence for the phase-flip 
error of single-photon pairs, as shall be studied latter. 

Theorem 1 shall also apply for the conventional BB84 
QKD by just regarding elements of any set there as a 
single pulse. Here in our application for MDI-QKD, £ 
shall be a set that contains pulse pairs from several real 
two-pulse sources. We shall regard pulse pairs of a spe¬ 
cific two-mode Fock state from £ as a set £;. Therefore 
in applying Theorem 1 later in this paper, we shall sub¬ 
stitute subscript i by double subscript mn in Theorem 
1 and C mn is a set that contains all pulse pairs of state 
|m)(m| (g> |ro)(n| from £. Before any further investigation, 
we list the following simplified mathematical notations 
first. 

(1) C lr : the set for all pulse pairs from source Ir; (Some¬ 
times we simply use notation Ir for C lr , if this does not 
cause any confusion.) 

(2) C mn : the set of pulse pairs of state \m)(m\ <g> |n)(n| 
from set C. For example, and £ m „ are sets for pulse 
pairs of state \rri)(m\®\n)(n\ from sets C lr and £, respec¬ 
tively. 

(3) S mn : y ield 0f set Cmn. Le -. S mn = S C% n - 
s mn : yield of set £ mn , i.e., s^ n = S Cmn - 

(4) Si r : yield of source Ir , i.e. S^ir. 
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In any real experimental set-up, the total pulses sent 
by both sides are finite. In order to extract the secure 
final key, the effect of statistical fluctuations caused by 
the finite-size key must be considered. In this case, in 
general 

stu * sZ (6) 

if l'r' ^ Ir. In this case, to obtain the lower bound value 
for sn (yield of single-photon pairs) and upper bound 
value of efj 1 (phase-flip rate of single-photon pairs), one 
can apply theorem 1 to a suitably chosen set of two pulse 
sources, V. As an example we choose (4lj| 

T> = {oo,ox,xo,oy, yo,xx, yy}. (7) 

To apply our theorem, we also need to choose set C. 
First, we use 


C = V. (8) 

We can write the density matrix of any two-pulse source 

Ir (E T> in the following form 

Pir = ^c l ^ n \m){m\®\n){n\. (9) 

m,n 

Relating this, we now define (Si r )c as 

(Slr) C =J2 C ™sin- ( 10 ) 

m,n 

According to this equation, we can list many equations 
(constraints) and hence calculate the lower bound of sf x 
either by formula or by linear programming, as shown in 
details in the Appendix. Therefore we have the following 
theorem: 

Theorem 2: In the non-asymptotic case, using the 
observed data (number of counts) of pulses in X basis 
and pulses from vacuum sources, e.g., pulse pairs from 
set T>, we can lower bound the yield of single-photon 
pairs in X basis, the yield of all single photon pairs in 
in both bases, and also the yield of those single photon 
pairs in Z basis only. 

In the Appendix we shall show the explicit formula for 
lower bound the yield of single-photon pairs in X basis 
by Ea. (l22l) . and the yield of all single-photon pairs in 
both X basis and Z basis by Ea. (E71) . In particular, the 
lower bound of the yield of the single-photon pairs is a 
functional of 7 i and 


B. Joint study for worst-case result of key rate 


We denote <S n (%) as the lower bound of sf) with a 
given value H. Note that H is defined by Eq. lfTTI) . The 
value <S n (%) can be calculated rather tightly if we use 
constraints in Ea. (l23l) . As shown in the Appendix, the 
value S n {TL) calculated by these constraints can also 
lower bound sf 1( the yield of all single-photon pairs be¬ 
cause there is a same set of constraints for quantities 
( Sir)c q as given by Eas. (l28l24[) . Here £ = V U Cff. 
Therefore we shall simply use one notation S_n(TL) for 
both the lower bound of sfj and the lower bound of sf x , 
given 77. Actually, using the method in Ref. [39], the 
functional S_ 11 (7i) can be analytically formulated. 

Second, we can also formulate the phase-flip error rate 
of single-photon pairs for all single-photon pairs [32j, HU, 
HU]. We regard this as a functional of 77. As its original 
definition in the Pauli channel model (lU, l43j . a phase- 

/ 1 0 \ 

flip error is a cr z = error that takes a phase 

l 0 -1 


shift in Z basis. We adopt this definition for all qubits in 
both A—basis and Z— basis. The a z errors on qubits in 
Z-basis are not physically detectable, but they do exist. 
The a z error on qubits in X basis can be detected, it is 
just the flipping error in the basis. We can deduce the a z 
error rate of all single-photon pairs through measuring 
the cr z error on those single-photon pairs in X basis only. 

Denote the oc-error yield of any set C by Tc, we have 
Tc = and fie is the number or error bits due to set 
C. Denoting T xx = Tc** we have 


'T — n xx T xx f10\ 

± xx — / , Wmn 

m,n 


where T™ n is error yield of set Cf r f n . Taking the same 
definition of set £ as used earlier, we define quantity 
{Txx}c 


{Txx)c=Y. c ™nTL- ( 13 ) 

m,n 


We can now apply our theorem 1 to make a non-trivial 
treatment for error yield and bound the phase-flip error 
all single-photon pairs in both bases. 


a£' < pP k - 

-n — e n — 


aibiS_n 


(14) 


Ti. = ao(S ox )c + bo(S xo )c — aob 0 (S 00 )c■ (H) 

Given theorem 2, we can actually deduce the lower 
bound of yield of single-photon pairs in Z basis through 
using the observed data in X basis only, even for the non- 
asymptotic calculation. This makes it possible to treat 
the yield of single-photon pairs and the phase-flip error of 
single-photon pairs jointly as shown below because both 
of them are dependent on the same quantity 7 ~L. We shall 
take a detailed study on this very important point below. 


and £ — {Txx}c ^o{To X }c b^lfT xo } -t- aabo{T 00 }&. 
This gives the phase flip error for all single-photon pairs 
by using observed data of source xx only. To a good 
approximation, this is also the phase-flip error rate of 
single-photon pairs in Z-basis only, because almost all 
single-photon pairs are from source zz. 

Theorem 3 Applying our theorem 1, together with 
Eq. ([HD one can obtain the upper bound of the phase-flip 
error rate (cr z -error rate) for all single-photon pairs by 
using observed data of source xx only. 





4 


Given the obvious fact that the bit flip error rate must 
be 50% if the bit is caused by source state of |0)(0| <g) p 
or p® | 0 }( 0 |, we have 

£xx = C T xx )c ~ \h. (15) 

We can therefore regard the upper bound of e p \ as func¬ 
tional of R as 


£n(H) = 


T xx + 1\ jF *— %/2 


oi6i<Sn 


> p ph 

— e n • 


(16) 


Therefore, we have the following key rate formula as a 
functional of TL 


K{H) = p ZA p ZB 

■ K z &i Z £n(?0[ 1 - H(£ n (.n)\ - fS zz H(E zz )}, 

where / is the error correction inefficiency and E zz is 
the observed bit error rate for source zz. The final key 
is simply the worst-case result of 1Z(R) over all possible 
values for H, i.e. 


R = min (18) 


According to Eq. (l24l) , we have X = [h — S,h + 5] and 


h = 
5 = 


0*0Sox A doSxo Uq Soo 

a 0 7 


N„ : 


a o7 


N n , 


(19) 


given the symmetric set-up that satisfies ao = bo, N xo = 
N ox ■ We shall use such a symmetric case in our numerical 
simulation. 



FIG. 1: (Color online) The optimized key rates (per pulse 
pair) versus transmission distance by different methods with 
device parameters being given by line a of Table JT] Here we 
set the total number of pulses at each side Nt = 10 10 and the 
failure probability e = 10 -7 . 



eo 

ed 

Pd 

Pd 

fe 

a 

0.5 

1.5% 

6.02 x 10" 6 

14.5% 

1.16 

b 

0.5 

1.5% 

10- 7 

40% 

1.16 

c 

0.5 

1% 

IQ" 7 

40% 

1.16 


TABLE I: Device parameters used in numerical simulations. 
Pd : the dark count rate, rjd- the detection efficiency of all 
detectors. / e : the error correction inefficiency. We shall use 
the device parameters of line a for the calculation of Fig. [T] 
and Table 1111 line b for calculation of Fig. [2] Fig. [3] Fig. [5] 
Fig. [6] and Table Hill and line c for the calculation of Fig. 4. 


IV. NUMERICAL SIMULATION 

In this section, we present some numerical simula¬ 
tions in comparison with the best known prior art re¬ 
sults Ref. j38|, 139[. We focus on the symmetric case where 
the two channel transmissions from Alice to UTP and 
from Bob to UTP are equal. We also assume that the 
UTP’s detectors are identical, i.e., they have the same 
dark count rates and detection efficiencies, and their de¬ 
tection efficiencies do not depend on the incoming signals. 
Also, we assume 

a k = b k , a k = b' k , a k = b k ( 20 ) 

for all k. And pi A = p rB for any l = r. 

We shall estimate what values would be probably ob¬ 
served for the yields and error yields_in the normal cases 
by the linear models as in |5j, |2l], |29|, [37t, HU. We shall 
assume 2 types of detectors. Ex per imental conditions 
and parameters of detectors [231, [44| are listed in Ta¬ 
ble I. For the second type of detector, we assume 40% 
detection and 10” 7 dark count rate, in Fig. (12l3l4j) . In 


Fig.©, we assumed the alignment error probability to 
be ed = 1%. With these, the yields and error rate can 
be simulated [29j, [37} ■ We assume a coherent state for all 
sources. The density matrix of the coherent state with 
intensity p can be written into p = e ^ |fc)(fc|. We 
calculate the key rate using Ea. (ll7ll8ll 


A. Numerical results 

Here we first take a simple treatment using normal 
distribution in order to make a fair comparison with the 
prior art results [38, [39}. This means that we can set 

A + = A_ = 7 yj and 7 = 5.3 given the failure prob¬ 
ability e = 10 -7 . We emphasize that no matter we use 
Clrernoff bound or the simple treatment, the conclusion 
that our method can hugely improve the key rates does 
not change. We use the full parameter optimizations for 
all protocols J38, ; 3£j. 

Fig. CTO) make a clear view that our method im- 
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FIG. 2: (Color online) The optimized key rates (per pulse 
pair) versus transmission distance by different methods with 
device parameters being given by line b of Table U Here we 
set the total number of pulses at each side Nt = 10 9 and the 
failure probability e = 10 -7 . 


FIG. 4: (Color online) The optimized key rates (per pulse 
pair) versus transmission distance by different methods with 
device parameters being given by line c of Table [T] Here we 
set the total number of pulses at each side Nt = 10 13 and the 
failure probability e = 10 -7 . 



Distance 

30 km 

35 km 

40 km 

50 km 

Xu et al.[38j 
Yu et al.[3ff] 

This work 

5.32 x 10 -9 

1.81 x 10 -7 

3.93 x 10 -6 

3.66 x 10" 8 

2.33 x 10 -6 

1.33 x 10 -6 

3.78 x 10 


TABLE II: Comparison of key rates at different distance 
(standard fiber) for calculations done in Fig. (JTJ). 

rate by 20-100 times in a typical parameter set. Table 
IV lists the optimized parameters of our method at 40 
km for our result in Table I and 50 km for our result in 
Table III. 


FIG. 3: (Color online) The optimized key rates (per pulse 
pair) versus transmission distance by different methods with 
device parameters being given by line b of Table U Here we 
set the total number of pulses at each side Nt = 10 11 and the 
failure probability e = 10 -7 . 


proves the final key rate and transmission distance drasti¬ 
cally, and the advantage is much more outstanding when 
the data size is smaller. 

In these figures, the black dotted curve is the key rate 
obtained from the method in Ref. (S3) , where fluctua¬ 
tions of each sources are treated separately. The blue 
dashed curve is the improved key rate using the method 
of our previous work in Ref. f39j, and the red solid curve 
is the result of this work. 

Table II and Table III list the key rates at different 
distances for different protocols. From the tables we can 
see that our method at this work can improve the key 


B. Results with higher security 

We have also calculated the key rates by using Cher- 
noff bound [32|, the conclusion that our method here can 
hugely improve the efficiency of MDIQKD keeps un¬ 
changed. Consider the Hefei experiment. For a fair 
comparison, we strictly use Chernoff bound with failure 
probability 10~ 10 . And also in the final key rate cal- 


Distance 

35 km 

50 km 

60 km 

Xu et al.[38j 

- 

- 

- 

Yu et al.[3ff] 

4.02 x 10' 7 

- 

- 

This work 

2.07 x 10 -5 

3.44 x 10 -6 

8.16 x 10" 7 


TABLE III: Comparison of key rate at different distance 
(standard fiber) for calculations done in Fig. ([5]). 
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P'X 

M y 

Hz 

Px 

Py 

Pz 

El 

0.071 

0.212 

0.280 

0.357 

0.121 

0.479 

uni 

0.078 

0.241 

0.252 

0.398 

0.138 

0.423 


TABLE IV: List of optimized parameters used in numerical 
simulations by the method of this work. Line [Til for 40 km in 
Table HH Line [In] for 50 km in Tabic [ITI1 


culation, we use the yield lower bound values of those 
single-photon pairs in Z basis only. Say, we shall re¬ 
place Sn(H) and £\\(W) in Eq. TTTl) by /c g< S 11 ('H) and 
K e (£u('H), respectively, where the factors k s , K e are in 
ranges around 1 due to the possible fluctuations between 
all single-photon pulses and those from zz source, for the 
quantities yield and phase-flip error rate, respectively. 
We use results of Ref.[28j] for bounds of k s , n e . 

Also, according to the observed data there[28j|. we used 
a linear loss model to estimate the actual over all loss in 
the experiment. Assuming the same device parameter, 
we make the optimization by using our 4-intensity pro¬ 
tocol. We obtain a final key rate of 0.98 bit per second 
(bps), which is more than 50 times higher than the re¬ 
ported experimental result, 0.0177 bps. 

Furthermore, consider the possibility fresh key appli¬ 
cation by our method. The standard of GSM requests a 
transmission rate in 13 kbps. Taking this standard, we 
calculate the key rates of different protocols with vari¬ 
ous total number of pulses from 10 9 to 10 10 , at a fixed 
distance of 50 km, as shown in Fig.©. From this fig¬ 
ure we can see that our protocol can fulfill the task of 
private mobile phone communication with only less than 
5.9 seconds delay if the system repetition rate is 1 GHz 
[45| . This is an impossible job for all prior art protocols. 
For a comparison, we also did the same calculation by 
Normal distribution approximation as used earlier, with 
the failure probability 10” 10 , in Fig.©. Here, we find 
the delay time of our protocol is only about 4.1 seconds 
if the system repetition rate is 1 GHz. 

V. CONCLUDING REMARK 

In real set-ups of MDI-QKD, the effects of statistical 
fluctuations caused by the finite-size key must be consid¬ 
ered. In the statistical analysis, earlier works [12, HI, 0 
used the simple worst-case calculation for single-photon 
yield and the phase-flip error rate separately, leaving the 
problem of difference between the error rate in X basis 
and the phase-flip error in Z basis. Here we used the 
more economic worse-case estimation pointing directly 
to the final key rate, and calculate the yield and phase- 
flip error rate directly Z-basis using the data in X-basis 
only. These improved the key rate drastically. Also, here 
in our protocol intensities of pulses at different bases can 
be different, this further improves the key rate. Also, we 
have shown that actually both the yield and the phase- 



FIG. 5: (Color online) The optimized key rates (per pulse 
pair) versus different total number of pulse pairs Nt for each 
protocols at the distance of 50 km. Here the failure proba¬ 
bility is e = 10 —10 , with the device parameters being listed 
in line b of Tabic [T| We strictly use Chernoff bound in the 
calculation. 


x 10 5 50km 



FIG. 6: (Color online) The optimized key rates (per pulse 
pair) versus different total number of pulse pairs Nt for each 
protocols at the distance of 50 km calculated by the Normal 
distribution approximation. Here the failure probability is 
also set to be 10 —10 , with the device parameters being listed 
in line b of Table |T] 

flip error rate of single-photon pairs can be calculated 
directly for all single-photon pairs using observed data 
in X basis only. As shown in the numerical simulations, 
the results obtained with our improved methods are much 
better than the results obtained before. In short, we have 
proposed a method that is much more efficient than all 
known methods for improving key rate in the decoy-state 
MDI-QKD. Our method has actually made the decoy- 
state MDI-QKD immediately useful in practice. 

In our calculation, we have chosen a special of sources 
for V in Eq.(7). As was pointed out already, there are 
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other choices, e.g., {oo,ox,xo,oy,yo,xx,xy,yx}\^§l ], lin¬ 
ear programming and so on. The method here can also 
be applied to the traditional decoy-state BB84 protocol, 
say Alice has vacuum source, source x, y in X basis and 
source z in Z basis as the signal source. They use vac¬ 
uum source and sources x, y to calculate the single photon 
yield and phase-flip error rate and use source z for key 
distillation. And also one can treat the single photon 
yield and phase-flip error rate jointly, taking the opti¬ 
mization directly pointing to the final key rate. This will 
be reported elsewhere. 
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Note added: Several months after we announced this 
work in arXiv 1502:01262 (2015), our method proposed 
in this work has been experimentally implemented very 
recently (H]. There, 1 GHz source repetition rate is 
demonstrated with pulses’ coherence length of 0.035 ns. 


VI. APPENDIX 

Given set C = V, using constraints 

(Sirk = (21) 

m,n 

as shown in Eq. m, we have 


£ c _ [a[b' 2 (S xx )c + aib 2 a'o{Soy)c + aib 2 U 0 {Syo) c] - [aib 2 (S yv )c + aib 2 a' 0 b' 0 {S oo ) c ] - a! Y b'{H 

11 11 aiai(&i &2 — 6162 ) ’ ( 22 ) 

and U = a 0 (S ox )c + b 0 (S xo ) c - a 0 b 0 (S oo )c- 


Since quantities (Si r )c are not exactly determined, we 
can only find out the lower bound for for sfq with con¬ 
straints for fluctuations given by Eq.([5]) in our theorem 
1. We can rewrite C in C = {C mn \m = 0,1, 2, • • • ; n = 
0,1, 2, • ■ • } where the subset C mn {C mn ) is for all pulse 
pairs in state \m)(m\ (g> \n)(n\ from set C (A4). We im¬ 
mediately find that for any source Ir £ V , C * l ^ n £ C mn 


and also C^ n £ C m n ■ Regarding each C l ^ n as M and 
{Cmn} as {-Mi} in our theorem, we find that condition 1 
in theorem 1 holds. Moreover, one can easily find that all 
conditions in our theorem 1 hold for sets {C lr ,£} above. 
Therefore we can use Eq. © for constraints of fluctua¬ 
tions. We shall use the following constraints: 


NirSir + Jy/Nir-Sir > Ni r (Si r )c > N ir Si r - jy/Ni r S [r ; for any Ir £ V 


Nyo(Syo)C + N 0 y(S 0 y)c ^ NyoSyo + NoySoy T 'x /NyoSyo "b Noy^oy 
N X x{S X x) C + Nyo(Syo) c + N 0 y{S 0 y) c ^ N XX S XX + NyoSyo + NoySoy 
Nyy{Syy)c + N 00 (S 00 ) £ < NyySyy + N ao S 00 + 7 \/ NyySyy + N 00 S 00 


ly/NxxSxx 


(23) 


and 


N ox S 0 x N xo S xo + 7 *\/ N 0 x&ox + N XO&XO Nxoi^xo) £ Nox{Sox}c N OX ^OX “ 1 ” ^xo^xo 7 \/ NoxSox + N xo^xo ( 24 ) 

I- 


The first line of Ea. (E3l) gives individual ranges of sta¬ 
tistical fluctuations related to each separate sources, the 
other lines are joint constraints among different sources, 
as was studied in detail in Ref. (Hi). 

Second, we use set 


and quantities 

= ( 26 ) 

m,n 

Note that C! is simply the set for pulse pairs from sources 
in T> and single-photon pairs from source zz. As shown in 
Ref. [li , the states in polarization space for single-photon 


£ = V\J 


(25) 














pairs in X basis or in Z basis are identical. Both of them {C lr ,£} above. Similar to Eg . (1221) . we have the lower 

are jl. Similar to the study above for set C, it is easy bound of by 

to see that all conditions in our theorem 1 hold for sets 

I 


C ^ c! [ai&2 {Sxx)o + aib 2 a' 0 (Soy)c’ + aib 2 b' 0 (Sy O )c] - [aib 2 (S yy )o + aib 2 a' 0 b' 0 (S O o)c] ~ a[b' 2 'H' 

Sll “- n ^ araU&i^-W ’ (27) 

and %' = a 0 (S ox )c + b 0 (S xo )c - a 0 b 0 (S O o)c'- 


And we shall use the following constraints from Eq. © in 
theorem 1: 


J 


NirSir + "/V N irSir > Xi r (Si r )c ' > Ni r Si r - ^\]Ni r Si r ; for any Ir G V 
Nyo(Syo) C' + Noy{S oy ) C ^ X yo S yo H - ^oy $oy \J NyoSyo + NoySoy 

N X x(S XX ) £' + Nyo(Syo) £' + N oy (S Q y) £' ^ X X X S XX N yo Syo T X Q y S 0 y ^ \/ X xx S X X A Xy 0 Sy 0 A X Q y S 0 y 

Xyy{Syy)c i 2 A X 00 (S 00 ) C’ A XyySyy + X 00 S 00 + "f XyySyy + X QO S QO 


(28) 


and 


X„ x Sox d - X xo S xo +7\/ X ox S OX N X o^XO ^ X xo {S xo )c' +X ox (S ox )c > X ox S OX Nxo^XO T y/N qx^ox H - ■^xo^xo (29) 


Therefore we arrive at the conclusion below: 

In the non-asymptotic case, the yield of single-photon 
pairs in X basis is lower bounded by Eg. h2ty) . and the 
yield of all single-photon pairs in both X basis and Z 
basis is lower bounded Eq. 

To a good approximation, we can regard the lower 
bound of sf x above as the lower bound of the yield of 
single-photon pairs in Z basis, since in our protocol most 
of (actually, almost all) single-photon pairs which can 
cause effective events are produced in Z basis. 

Also, compare Eg. (1221) and Eg. (1271) we find that, the 
right side of Eq. (1271) actually has the same form of the 
right side of Ea. (l22l) . but with subscripts C of (Si r ) and 
H in Ea. (1221) being replaced by subscripts C and . 
Obviously, according to the definition of C and £, we 
immediately find that 

H = W. (30) 


We shall simply use the notation H for both of them. 
Also, we can easily see that, constraints to ( Si r )c listed 
in Eas. (1281291) are identical to constraints to (Si r )c as 
listed in Eas. (1231241) . Therefore, given "H, the lower 
bound of sfi calculated from Ea. (1221) and Eos. (1231241) 
must be equal to the lower of calculated from Eg. (1271) 
and Eas. (l28l29l) . And hence we can use only one func¬ 
tional form fiiiiH) for both the lower bound of sf x and 
the lower bound of sf\. 

Given theorem 2, we can actually deduce the lower 
bound of yield of all single-photon pairs basis through 
using the observed data in A' basis only, even for the non- 
asymptotic calculation. This makes it possible to treat 
the yield of single-photon pairs and the phase-flip error of 
single-photon jointly because both of them are dependent 
on the same quantity TL. This makes an important part 
to improve the efficiency of our key rates. 
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